Loading story…
Red Hat released updated Apache HTTP Server 2.4 packages for Red Hat Enterprise Linux 7 and Red Hat Software Collections 2 to remediate CVE-2015-3185. The flaw affected modules that used the obsolete ap_some_auth_required() API: when access was controlled only by a Require authorization rule, the API could incorrectly indicate that authentication was required, potentially causing an affected module to grant access that should have been denied. Apache replaced the API with ap_some_authn_required and added an ap_force_authn hook; the upstream fix shipped in Apache HTTP Server 2.4.16.
The Red Hat updates also addressed CVE-2015-3183 request smuggling caused by inconsistent chunked-transfer parsing between httpd and front-end proxies, along with WebSocket Ping denial-of-service and error-response child-process crash flaws in the Software Collections packages. Administrators should apply the updated httpd or httpd24-httpd packages; fixes were backported and installation restarts the service automatically. Red Hat Enterprise Linux 6 and earlier base httpd packages were not affected by CVE-2015-3185 because they use Apache 2.2 or 2.0.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat published RHSA-2015:1667 for Red Hat Enterprise Linux 7, providing updated httpd packages with backported fixes for CVE-2015-3185 and CVE-2015-3183. The advisory rated the update Moderate severity and advised affected users to upgrade.
Fedora released httpd-2.4.16-1.fc21 to the Fedora 21 stable repository, incorporating the upstream fix for CVE-2015-3185.
Fedora released httpd-2.4.16-1.fc22 to the Fedora 22 stable repository, incorporating the upstream fix for CVE-2015-3185.
Red Hat later included fixes for affected Red Hat JBoss Core Services products in RHSA-2017:2708, RHSA-2017:2709, and RHSA-2017:2710.
Red Hat issued updated httpd24-httpd packages for Red Hat Software Collections 2 through RHSA-2015:1666. The update backported fixes for CVE-2015-3185 and other Apache HTTP Server vulnerabilities, and Red Hat advised users to upgrade.
Apache HTTP Server 2.4.16 became the first released upstream version to include the CVE-2015-3185 fix.
Apache replaced the obsolete ap_some_auth_required() API with ap_some_authn_required() and an ap_force_authn hook to address CVE-2015-3185. The fix was implemented in unreleased upstream versions 2.4.14 and 2.4.15.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
ubuntu.com
Open sourcerhn.redhat.com
Open sourcerhn.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for `httpd:2.4` across multiple Red Hat Enterprise Linux 8 support channels to remediate two Apache HTTP Server vulnerabilities, **CVE-2025-55753** and **CVE-2025-58098**. The first flaw affects `mod_md` ACME certificate renewal handling in Apache HTTP Server versions `2.4.30` through `2.4.65`, where an integer overflow can drive the renewal backoff timer to zero after repeated failures and trigger continuous retry attempts until renewal succeeds. The second flaw affects Apache HTTP Server before `2.4.66` when **Server Side Includes** is enabled with `mod_cgid`, causing the shell-escaped query string to be passed to SSI `#exec cmd="..."` directives. The fixes were shipped through advisories including **RHSA-2026:0009**, **RHSA-2026:0010**, **RHSA-2026:0011**, and **RHSA-2026:0012**, covering RHEL 8.2, 8.4, 8.6, and 8.8 service variants such as AUS, EUS, SAP, Telecommunications, and Advanced Mission Critical Update Support. Updated packages include `httpd`, `mod_md`, `mod_http2`, `mod_ssl`, `mod_ldap`, `mod_proxy_html`, and `mod_session` for supported architectures, while Apache identified version `2.4.66` as the upstream fix level for both issues.
Aug 21, 2026
Red Hat published **Important** security updates for Apache HTTP Server packages across **Red Hat Enterprise Linux 8, 9, and 10** and related JBoss Core Services offerings, addressing multiple upstream `httpd` vulnerabilities. The updates remediate **CVE-2025-65082**, which can let Apache configuration-set variables unexpectedly override server-calculated CGI environment variables, and **CVE-2025-66200**, a `mod_userdir` + `suexec` bypass in which an attacker able to use the `RequestHeader` directive in an `.htaccess` file may cause some CGI scripts to run under an unexpected user ID. Red Hat advisories for RHEL 9 and 10 also include fixes for **CVE-2025-58098**, where Server Side Includes appends the query string to `#exec cmd`, while the RHEL 8 `httpd:2.4` module update additionally addresses **CVE-2025-55753**. The affected Apache HTTP Server ranges extend through **2.4.65**, and upstream guidance points users to **2.4.66** for remediation. Red Hat shipped patched builds including `httpd-2.4.62-7.el9_7.3` for RHEL 9 and `httpd-2.4.63-4.el10_1.3` for RHEL 10, with corresponding package updates across major architectures and lifecycle channels; the RHEL 8 advisory likewise delivers updated `httpd`, `mod_ssl`, `mod_http2`, `mod_md`, and related components. The fixes were released under advisories **RHSA-2025:23732**, **RHSA-2025:23919**, and **RHSA-2025:23932**.
Aug 21, 2026
The Apache Software Foundation released **Apache HTTP Server 2.4.67** to fix five vulnerabilities, led by **`CVE-2026-23918`**, an important- to high-severity flaw in the HTTP/2 implementation. Apache said the bug is a **double free** triggered by an early reset that could lead to **remote code execution**, and that it affects **version 2.4.66**. The issue was reported in December 2025 and fixed shortly afterward, with public disclosure following on the `oss-sec` mailing list; Bartlomiej Dmitruk of striga.ai and Stanislaw Strzalkowski of isec.pl were credited with finding it. The 2.4.67 release also patches **`CVE-2026-24072`** in `mod_rewrite`, which can allow local `.htaccess` authors to read arbitrary files as the `httpd` user, along with lower-severity issues in `mod_proxy_ajp`, `mod_md`, and `mod_dav_lock`. Apache and downstream reporting urged organizations running **2.4.66 or earlier** to upgrade immediately, while temporary mitigations for environments that cannot patch at once include disabling **HTTP/2**, removing `mod_dav_lock`, and reviewing `.htaccess` permissions.
Jun 29, 2026